Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: add binary input reader and BIFs for sending in data.

Browse source 
This allows the input framework to feed files in to Bro for analysis.
This commit is contained in:
Jon Siwek 2013-03-06 12:59:54 -06:00
parent c330b46128
commit 00b2d34a8e
14 changed files with 399 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/file_analysis/Manager.h
View file

@ -35,31 +35,31 @@ public:
*/
void DataIn(const string& unique, const u_char* data, uint64 len,
uint64 offset, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* Pass in sequential file data.
*/
void DataIn(const string& unique, const u_char* data, uint64 len,
Connection* conn = 0, const string& protocol = "");
Connection* conn = 0, const string& source = "");
/**
* Signal the end of file data.
*/
void EndOfFile(const string& unique, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* Signal a gap in the file data stream.
*/
void Gap(const string& unique, uint64 offset, uint64 len,
Connection* conn = 0, const string& protocol = "");
Connection* conn = 0, const string& source = "");
/**
* Provide the expected number of bytes that comprise a file.
*/
void SetSize(const string& unique, uint64 size, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* Starts ignoring a file, which will finally be removed from internal
@ -109,7 +109,7 @@ protected:
* record value may be updated.
*/
Info* GetInfo(const string& unique, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* @return the Info object mapped to \a file_id, or a null pointer if no